Splunk Search

timechart sorting multiple fields

balash1979
Path Finder

I have the following query

index="search_index  | timechart avg(time1) as time1_in_mins ,avg(time2) as time2_in_mins |  sort time1 | tail 5 | sort time2 | tail 5

Basically, i want to show timechart values for 2 times and I want to sort both the times and show the top 5 values. By doing the above search, time2 is the one that gets sorted correctly. How can I fix the above query to sort both times.

0 Karma

HiroshiSatoh
Champion

Is this possible?

If there are 5 each

index="search_index  | timechart avg(time1) as time1_in_mins  |  sort time1_in_mins  | tail 5
|append [search index="search_index  | timechart avg(time2) as time2_in_mins | sort time2_in_mins | tail 5]

If there are 5 cases in total

index="search_index  |bin span=1h |stats (time1) as time1_in_mins ,avg(time2) as time2_in_mins by _time
|eval time=if(time1_in_mins <time2_in_mins,avtime1_in_mins,time2_in_mins)
|sort time|tail 5
0 Karma

balash1979
Path Finder

I have tried this way of appending 2 searches but the issue is if the first search completes first and the 2nd search takes time, the results dont come out correctly. Is there a way for the overall query to wait until both searches complete ?

0 Karma

HiroshiSatoh
Champion

Subsearch has the following restrictions.

[subsearch]: Search auto-finalized after time limit (60 seconds) reached.

It is necessary to change “limits.conf”.
https://answers.splunk.com/answers/267303/why-does-my-subsearch-maxtime-setting-in-limitscon.html

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...